Install and ordinary import execute an obfuscated DNS beacon. It transmits host-identifying metadata to an attacker-controlled subdomain.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install or requiring the package entrypoint
Impact
Leaks username, hostname, working-directory name, and timestamp to a remote DNS operator.
Mechanism
obfuscated DNS exfiltration of local host metadata
Attack narrative
The install hook invokes index.js, which silently requires lib/core.js; normal imports do the same. That module decodes its dependencies and builds a DNS label containing a fixed marker, OS username, hostname, cwd basename, timestamp, and oob.sl4x0.xyz, then calls dns.resolve4. This is covert, unconsented exfiltration rather than package utility behavior.
Rationale
Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.
Evidence
package.jsonindex.jslib/core.jslib/b02e30.jslib/6ad264.jssrc/network.js